CVE-2026-72374 afs: Fix callback service message parsers to pass through -EAGAIN
A flaw in the Linux kernel AFS callback parser mishandles incomplete data, potentially causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72374?
CVE-2026-72374 is a high-severity denial of service vulnerability in Linux, published on 15 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
afs: Fix callback service message parsers to pass through -EAGAIN
The AFS filesystem client uses an rxrpc server to listen for callback notifications. Each callback call type handler has a delivery function that parses the incoming request stream, and this should return -EAGAIN the last packet hasn't yet been seen, but all currently queued received data is consumed. afs_extract_data() does this, but the -EAGAIN return is switched to 0 inadvertantly
Fix callback service message parsers to pass through -EAGAIN
Which versions are affected by CVE-2026-72374?
How do I fix CVE-2026-72374?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-72374 being exploited?
There is no known exploitation of CVE-2026-72374 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-72374, DEBIAN-CVE-2026-72374, GHSA-82qr-pqhc-837w, UBUNTU-CVE-2026-72374.